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Amendment to the Claims : 
This listing of claims replaces all prior versions, and 
listings, of claims in the application: 

1. (Currently Amended) A method comprising; 
determining at a first classifying forwarding element if a 

classification parameter is available for internet Protocol 
security (iPsec) traffic that indicates a route for the IPsec 
traffic and classifying Baid traffic if available; 

if said classification parameter is not available, and the 
IPsec traffic is encrypted then decrypting traffic in a 
decrypting forwarding element separate from the first 
classifying forwarding element after said traffic has passed 
through said classifying forwarding element, and determining the 
classification parameter for the IPsec traffic < afe the decrypting 
forwarding clement ; and 

forwarding the IPsec traffic based on the classification 
paramete r; and 

providing the classification parameter to the first 
classifying forwarding element , 

2. (Previously Presented) The method of claim 1 further 
comprising receiving the IPsec traffic at the classifying 
forwarding element. 
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3. (Original) The method of claim l in which the 
classification parameter includes a security parameter index 
(SPI) associated with the IPsec traffic, 

4. (Original) The method of claim 1 in which the IPsec 
traffic includes a data packet. 

5. (Currently Amended) The method of claim 1 further 
comprising forwarding receiving at the first classifying 
forwarding element other IPeec traffic included in a traffic 
stream with the IPsec traffic , and further comprising forwarding 
the other IPaec traffic based on the provide d classification 
parameter . 

6. (Currently Amended) An article comprising: 

a machine-readable medium which stores machine-executable 
instructions, the instructions causing a machine to: 

determine at a first mechanism if a classification 
parameter is available for Internet Protocol security (IPsec) 
traffic that indicates a route for the IPsec traffic; 

if a classification parameter is not available, 
sending said traffic to a second mechanism separate from the 
first mechanism after said traffic has passed said first 
mechanism, and which second mechanism decrypts the IPsec traffic 
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if the iPeec traffic is encrypted and determine the 
classification parameter for the IPsec traffic at the occond 
mcchaniom ; &rA 

forward the IPeec traffic based on the classification 
parameter ; and 

provide the classification parameter to the first 
mechanism . 

7. (Original) The article of claim 6 further causing a 
machine to receive the IPsec traffic at the first mechanism. 

8. (Original) The article of claim 6 in which the 
classification parameter includes a security parameter index 
(SPI) associated with the IPsec traffic. 

9. (Original) The article of claim 6 in which the IPsec 
traffic includes a data packet. 

10. (Currently amended) The article of claim 6 further 
causing a machine the first mechanism to forward other IPsec 
traffic included in a traffic stream with the IPsec traffic 
based on the provided classification parameter. 
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11. (Currently Amended) A system comprising: 

a classifying forwarding element configured to communicate 
with a network, to determine if a classification parameter that 
indicates a route for a traffic stream is available for a packet 
included in the traffic stream; aad 

a control element in communication with the classifying 
forwarding element, the control element configured to receive 
information including classification information for the traffic 
stream and cryptographic information for the traffic stream, the 
control element further configured to transmit at least some 
classification information to the classify in g forwarding element 
and to transmit at least one key based on the cryptographic 
information to a decryption forwarding element separate from the 
classifying forwarding element; and 

wherein the decryption forwarding element is configured to 
receive the packet: from the classifying forwarding element, and 
to perform an encryption- related procedure on the packet if the 
packet is encrypted and associated with a known 
encryption related the at least one ke y, and determine oaid 
claasif ication parameter — if tho olaoaif ication parameter io 
available from cither of oaid forwarding clcmcntoy to forward f 
the paokot baocd on the route for the traffic oteream . 
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12. (Currently Amended) The system of claim 11 wherein the 
control element is configured to receive at least some of the 
cryptographic information in an Internet Key Exchange 
packet furthor comprioing a third mochaniom configured to 
uuu muinicato with tho olaooifying forwarding clement and with the 
decryption forwarding element and to determine a olaooif ication 
parameter for the packet if a classificatio n parameter io not 
available . 

13. (Currently Amended) The system of claim 12 in which 
the second mechanism is also configured to forward the packet to 
the third mcchaniom control element if the packet is not 
associated with a known encryption-related key. 

14 . (Currently Amended) The system of claim 12 , wherein 
the decryption forwarding element is included in a plurality of 
decryption forwarding elements, each in communication with at 
least one server of a plurality of servers, and wherein the 
control element includes security information for each of the 
plurality of servers in which tho third mcchoniom io aloo 
c onfigured to, — after duLermiiiing the clasoif ication parameter 
for the packet , — forward the claooif ication parameter to the 

f irot mechanism . 
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15 . (Currently Amended) The system of claim 12 , wherein 
the cryptographic information includes an encrypt ion- related key 
in which - thc third mochaniom ±o aloo oonf igurod - feo, after 
d u b uiiui ining tho encryption related key for the packet, — i orword 
fe he-encryption related key to the decryption forwarding clcmonfc 
ao that the decryption forwarding clement can perform tho 
encryption related procedure ■ 

16 . (Cancelled) 

17. (Previously Presented) The system of claim 11 further 
comprising a plurality of additional mechanisms, each additional 
mechanism configured to communicate with the classification 
forwarding device to perform an encryption- related procedure on 
the packet if the packet is encrypted and associated with a 
known encryption-related key, and, if the classification 
parameter is available, to forward the packet based on the route 
for the traffic stream. 

18. (Original) The system of claim 11 in which the packet 
includes an Internet Protocol security data packet. 
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19. (Original) The system of claim 11 in which the traffic 
stream includes a plurality of Internet Protocol security data 
packets . 

20. (Original) The system of claim 11 in which the first 
mechanism is also configured to forward the packet to the second 
mechanism if the packet is encrypted, 

21. (Original) The system of claim 11 in which the route 
for the traffic stream includes a route through a network. 

22. (Original) The system of claim 21 in which the network 
includes an Internet . 

23. (Previously Presented) The system of claim 11 in 
which the encryption-related procedure includes encrypting the 
packet . 



24. (Previously Presented) The system of claim 11 in 
which the encrypt ion- related procedure includes decrypting the 
packet . 

25. (Original) The system of claim 11 further comprising 
another mechanism configured to receive the packet from the 
second mechanism and to forward the packet based on the route to 
an ultimate destination of the packet. 
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26. (Original) The system of claim 11 in which the firgt 
mechanism is also configured to route packets included in the 
traffic stream based on a load balancing scheme. 

27-30, (Cancelled) 
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